← All audiences

CA Operator

Run a CA without a single trusted key.

Recommended journey

  1. 1. Evaluate

    Read the PKI product overview.

  2. 2. Prototype

    Run a threshold CA locally.

  3. 3. Audit

    Anchor certificates to a transparency log.

Primary Confium products

Confium PKI

Run a CA without a single trusted key.

Confium Transparency

Prove your operations are auditable and tamper-evident.

Use cases for this audience

HSM Replacement

Replace a single-key HSM with T-of-N distributed signing. No single party can sign alone; compromising T-1 parties does not compromise the key.

Confium Threshold

Threshold CA Signing

Operate a certificate authority where the root key is split across multiple parties. Issue certifies requires T-of-N quorum.

Confium ThresholdConfium PKI

Sovereign PKI

Operate a national or industry PKI where the root of trust is held by a quorum of institutional parties rather than a single operator.

Confium ThresholdConfium PKI

Certificate Transparency

Run an RFC 6962 transparency log for your CA. Every issued cert is appended; mis-issuance is detectable.

Confium TransparencyConfium PKI

OCSP / CRL from Threshold Keys

Operate OCSP responders and CRL signing from threshold keys. No single party can revoke or attest alone.

Confium PKIConfium Threshold

ACME Automation

Integrate ACME protocol with threshold-backed certificate issuance. Drop-in for certbot-style automation.

Confium PKI